I am setting up port spanning for the first time on a 2960 and it seems pretty straightforward but I have a few questions. Both ports are in the same vlan on the same switch. When I try to set the encapsulation to dot1q on the destination port I can't. My only choisces are replicate or native. Also I did not specify just tx or just rx but when I run the show monitor session command it says both but also says ingress disabled. Am I monitoring tx and rx? Why does it say ingress disabled?
Here is the show monitor session output:
CH-MDF9-2960#sh monitor session 1
Type : Local Session
Source Ports :
Both : Gi0/34
Destination Ports : Gi0/24
Encapsulation : Replicate
Ingress : Disabled
set it as both for ingress and egress traffic bidirectional , you cant make changes to the destination port thats considered a monitoring port as soon as you set it as destination in span , you can see this by doing a show int g0/24 should say monitored , this is where your pc connects with wireshark , nothing required after setting the destination port usually so encapsulation/native should not be required just optional
if you want to monitor multiple ports you can have multiple sources or you can monitor the whole vlan any ports belonged to that vlan the traffic will be collected , you only have 1 source above just create a second line monitor source or you might have a comma , option after stating first source port g0/34
monitor session 1 source interface Gi0/34
monitor session 1 destination interface Gi0/24 encapsulation replicate
These are the commands I used. I only want to monitor both ingress and egress traffic through Gi0/34 on port Gi 02/4. I thought that if you didn't specify Tx or Rx in the above commands then you would automatically be monitoring both ingress and egress.
How would I change these commands to accomplish what I stated?